LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC

In the Linux kernel, the following vulnerability has been resolved: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC Actually ENETC VFs do not support HWTSTAMP_TX_ONESTEP_SYNC because only ENETC PF can access PMa_SINGLE_STEP registers. And there will be a crash if VFs are used to test one-step timestamp, the crash log as follows. [ 129.110909] Unable to handle kernel paging request at virtual address 00000000000080c0 [ 129.287769] Call trace: [ 129.290219] enetc_port_mac_wr+0x30/0xec (P) [ 129.294504] enetc_start_xmit+0xda4/0xe74 [ 129.298525] enetc_xmit+0x70/0xec [ 129.301848] dev_hard_start_xmit+0x98/0x118

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-21894 is a Linux kernel bug in the ENETC network driver. When ENETC virtual functions are used with unsupported one-step transmit timestamping, the kernel can crash. Business impact is mainly availability on systems using this specific hardware and virtualization feature.

Executive priority

Prioritize for environments using ENETC VFs in production, especially where network availability is critical. For most organizations, urgency is lower unless this specific hardware and timestamping configuration is present.

Technical view

ENETC VFs do not support HWTSTAMP_TX_ONESTEP_SYNC because only the ENETC PF can access PMa_SINGLE_STEP registers. The vulnerable path can reach enetc_port_mac_wr during transmit and trigger a kernel paging fault. Linux stable commits resolve the issue.

Likely exposure

Exposure appears limited to Linux systems using the ENETC driver with virtual functions and one-step hardware transmit timestamping. General Linux deployments without ENETC VFs are unlikely to be affected based on the provided sources.

Exploitation context

No KEV listing or cited source indicates active exploitation. The public record describes a crash during testing of one-step timestamping on VFs, not remote code execution or data theft.

Researcher notes

The CVE record lacks CVSS, CWE, and exploitability details. Analysis is based on the kernel commit description and CVE metadata. Treat affected-version mapping through your distribution vendor because kernel fixes are often backported.

Mitigation direction

  • Update to a vendor or distribution kernel containing the referenced Linux stable fixes.
  • Avoid HWTSTAMP_TX_ONESTEP_SYNC on ENETC virtual functions until patched.
  • Use vendor-supported timestamping modes or ENETC PF behavior where appropriate.
  • Monitor Linux distribution advisories for backported fixes.

Validation and detection

  • Inventory Linux hosts using ENETC network hardware and SR-IOV virtual functions.
  • Check kernel package versions against vendor advisories and linked stable commits.
  • Review configurations for one-step transmit hardware timestamping on ENETC VFs.
  • Confirm patched systems no longer allow the unsupported VF timestamping path.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21894 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux41514737ecaa603a5127cdccdc5f17ef11b9b3dc, 41514737ecaa603a5127cdccdc5f17ef11b9b3dc, 41514737ecaa603a5127cdccdc5f17ef11b9b3dc, 41514737ecaa603a5127cdccdc5f17ef11b9b3dcunaffected
LinuxLinux5.3, 0, 6.6.83, 6.12.18, 6.13.6, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.